Privacy notice updated on 26 October 2026. Browsing, initial enquiries and service communications.
1. Controllers and handling of enquiries
Mirko Giorgi, independent registered nurse, Florence OPI no. 11614, VAT no. 07481660483, email mirko.giorgi.rn@gmail.com; Isaac Monchi, independent registered nurse, Florence OPI no. 11546, VAT no. 07425450488, email isaac.monchi@gmail.com.
Initial enquiries are received by both nurses, who jointly determine how they are managed and assigned and have established an agreement under Article 26 GDPR for this shared phase.
Essential content of the agreement: both receive and organise enquiries; after assignment the assigned nurse independently manages care, documentation and payment, while the other deletes unnecessary copies. Each manages their own mailboxes and devices; both cooperate on rights and incidents relating to the shared phase. For this phase individuals may contact either nurse regardless of the internal allocation of responsibilities.
For subsequent care, the assigned nurse is controller for their professional activity and provides the relevant privacy information before the service. The hosting account is held by Mirko Giorgi, who manages technical access personally with two-factor authentication.
2. Data, purposes and legal bases
To reply and arrange services, we may process names, contact details, town or area, service of interest and organisational information about materials that the person chooses to provide. The first message does not request diagnoses, symptoms, medical reports, photographs or a full address. The service itself may reveal health information: avoid unnecessary details.
Handling enquiries and pre-contractual steps requested by the person is based, where applicable, on Article 6(1)(b) GDPR; legal obligations on Article 6(1)(c). For health data necessary for care by professionals bound by professional secrecy, Article 9(2)(h) and 9(3) apply where their conditions are met. Unnecessary health data must not be requested through the initial contact.
Providing contact details is optional, but without sufficient information a reply or service arrangement may not be possible. No marketing, profiling or automated decision-making is provided. This website notice does not replace the information relating to healthcare and digital delivery of reports.
3. Handling and retention of documentation
Data are processed only as necessary to handle enquiries, provide and document services, and meet professional, administrative and tax obligations.
Enquiries that do not result in an appointment are deleted when the enquiry is closed, unless specific retention is required by law or in connection with a dispute. After assignment, the other nurse deletes unnecessary copies; the assigned nurse independently manages care documentation.
Retention criteria for relevant care documentation, including any copies of prescriptions obtained and reports needed to document the service, take account of the duration of the care relationship, applicable obligations and relevant time limits for establishing, exercising or defending legal claims. Disputes may require relevant documents to be retained until their resolution. The assigned nurse provides specific information about handling and retention before the service.
Copies created solely to transmit documents are deleted once delivery is complete and they are no longer needed. Administrative and tax documents follow their respective statutory retention periods.
Deletion of enquiries concerns copies in mailboxes and devices under the nurses’ control. Technical retention by providers and backups does not mean immediate erasure from every infrastructure. For technical browsing data, see the hosting section.
4. Laboratory portal and delivery of reports
Patients can consult laboratory reports through the laboratory’s portal. The confidential access sheet may be delivered on paper or according to the laboratory’s procedure agreed with the patient, after verifying the recipient. If emailed, the document is password-protected and the password is communicated separately through a different channel. Keep these credentials secure, as they give access to confidential information.
Protected email exchange has been agreed with the collaborating cardiologist for both the ECG recording sent for interpretation and the report returned to the assigned nurse. Attachments are password-protected and the password is communicated separately through a different channel.
Report delivery arrangements are agreed with the patient. If sent by email, the report is delivered as a password-protected attachment and the password is communicated separately through a different channel. Other delivery arrangements may be agreed subject to confidentiality and applicable security safeguards.
The digital service is optional: specific information is provided before agreement to the service, and the patient’s choice is recorded. Declining digital delivery does not prevent healthcare, and paper delivery can be arranged. The website does not host reports or patient archives and does not automatically send medical documentation.
The identities of the laboratory and cardiologist and their respective roles in data flows are disclosed in the relevant information before processing. Health information is not published or shared for promotional purposes.
5. Browsing and Cloudflare Pages hosting
The website uses Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Delivery and security of the service involve processing technical data such as IP addresses, HTTP requests, browser or device information and traffic data. Cloudflare Web Analytics is disabled.
Technical processing necessary for website delivery and security is based on the legitimate interest in making pages available and protecting them, under Article 6(1)(f) GDPR. Cloudflare processes data on the customer’s behalf within the scope of its Data Processing Addendum (DPA), incorporated into the service agreement, and may also process data for its own purposes described in its privacy policy.
Cloudflare uses international infrastructure: data are not necessarily processed only in the European Union. For transfers to the United States, the DPA provides for the Data Privacy Framework where applicable and, for restricted transfers, the European Commission’s standard contractual clauses and additional safeguards set out therein. Copies or information about safeguards can be requested through the contacts on this page.
The website operator does not maintain an independent archive of visitor logs. Technical data processed by the provider are retained for as long as necessary for delivery and security purposes and applicable obligations described in its terms and privacy policy.
6. Email, cookies and website features
The pages do not use profiling cookies, application analytics, advertising pixels, embedded maps or geolocation. Images, animations and code are local, and system fonts are used. Language switching and profile expansion do not store preferences in the browser. Any provider tools necessary for delivery or security are distinct from advertising or profiling tools.
Email links open the user’s chosen email app or Gmail. The website prepares recipients, subject and text but does not send the message: it is sent only when the user confirms in their email service. Opening Gmail also provides that service with the prefilled text containing the selected service.
The listed mailboxes use Gmail. Google processes data and messages under the terms applicable to the service; exclusive EU storage is not guaranteed. Google’s privacy policy can be consulted before choosing the external link. Communications should be limited to what is necessary; suitable arrangements are agreed for medical documentation.
The website has no form submitting data to a server, patient database or document-upload features. Do not send clinical information through initial contact.
7. Your rights and contacts
Subject to Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability and object to legitimate-interest processing. Erasure does not automatically override applicable retention duties. Any withdrawal relates only to consent-based processing.
Requests may be sent to mirko.giorgi.rn@gmail.com or isaac.monchi@gmail.com with “Privacy request”, without unnecessary medical documentation. Either nurse can be contacted for the shared phase; contact the assigned nurse for care. Requests must be handled under Article 12 GDPR, with proportionate identity checks where necessary.
You may lodge a complaint with the Italian data protection authority (Garante). This page is updated when arrangements, providers or website features change.
